4 commits

Author	SHA1	Message	Date
Alexandre Brandizzi	fe5f27c8e1	test(auth): build the password-policy service with the reset queue, throttle and keyed hash	2026-09-25 14:08:30 -03:00
Alexandre Brandizzi	ea1370847f	test(auth): move the password-policy reset case onto hashed, attempt-counted codes	2026-09-25 13:46:37 -03:00
Alexandre Brandizzi	9091335ff2	fix(auth): reject an unconfirmed new password and report only policy failures as weak	2026-09-25 13:02:58 -03:00
Alexandre Brandizzi	66a49ab957	feat(auth): enforce one password policy on every password-setting path (SH-386) ... Both hosts now apply the same Identity password rule: at least 6 characters with one uppercase letter, one number and one special character. Change password requires an authenticated caller, verifies the current password before evaluating the new one, and reports a policy rejection separately from a wrong current password.	2026-09-25 11:06:42 -03:00